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AppIiBntis) 

Shipley, Peter M. 



Examiner 

Pierre Eddy Elisca 



Group Art Unit 
2785 




IXI Responsive to connmunication(s) filed on Dec 16, 1999 . 

IS This action is FINAL. 

□ Since this application is in condition for allowance except for fornnal nnatters, prosecution as to the merits is closed 
in accordance with the practice under Ex parte Quay/e, 1935 CD. 11; 453 O.G. 213. 

A shortened statutory period for response to this action is set to expire THREE month(s), or thirty days, whichever 
is longer, from the nnalling date of this connmunication. Failure to respond within the period for response will cause the 
application to become abandoned. (35 U.S.C. § 133). Extensions of time may be obtained under the provisions of 
37 CFR 1.136(a). 

Disposition of Claims 

Kl Claim(s) 1-27 is/are pending in the application. 

Of the above, claim(s) none is/are withdrawn from consideration. 

Kl Ciaim(s) 1-6 and 8-20 is/are allowed. 

Kl C!aim(s) 27-27 is/are rejected. 

□ Claim (s) is/are objected to. 

□ Claims are subject to restriction or election requirement. 

Application Papers 

□ See the attached Notice of Draftsperson's Patent Drawing Review, PTO-948. 

□ The drawing(s) filed on is/are objected to by the Examiner. 

□ The proposed drawing correction, filed on is Cipproved Qlisapproved. 

□ The specification is objected to by the Examiner. 

□ The oath or declaration is objected to by the Examiner. 

Priority under 35 U.S.C. § 119 

□ Acknowledgement is made of a claim for foreign priority under 35 U.S.C* § 1 19(a)-(d). 

□ AN □ Some* DNone of the CERTIFIED copies of the priority documents have been 

□ received. 

□ received in Application No. (Series Code/Serial Number) . 

□ received in this national stage application from the International Bureau (PCT Rule 17, 2(a)). 

*Certified copies not received: 

□ Acknowledgement is made of a claim for domestic priority under 35 U.S.C. § 119(e). 

Attachment(s) 

Kl Notice of References Cited, PTO-892 

□ Information Disclosure Statement(s), PTO-1449, Paper No(s), 

□ Interview Summary, PTO-413 

□ Notice of Draftsperson's Patent Drawing Review, PTO-948 

□ Notice of Informal Patent Application, PTO-152 
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OF Cn. 

fJ- «^ ^ Examiner Pierre Eddy Elisca 

★ United States Department of Commerce 
Patent and Trademark Office 
Washington, D. C. 20231 




DETAILED ACTION 



Response to Amendment 
1. This office action is in response to Applicant's amendment filed on 12/16/1999. 



Allowable Subject Matter 

2. Claims 1-6, 8-20 are allowed over the prior art. 



Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103 (a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 
102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the 
subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 
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4. Claims 21-27, are rejected under 35 U.S.C. 102 (e) as being anticipated by Shwed (U.S. Pat. 
No. 5,606,668) in view of Hershey et al (U.S. Pat. No. 5,414,833). 

As per claims 21- 27, Shwed substantially discloses the claimed limitations of a computer 
product which includes codes on a computer readable medium wherein codes are being executed by 
a computer system . Not specifically discloses by Shwed are the steps of detecting a code wherein 
known improper code is detected and the detected pattem operational is detected over time. 
However, Hershey et al. discloses a security agent, consisting of a monitor and a responder, that 
respond to a detected security event in a data communications network. The security agent detects 
the transmission of infected programs (detect code operation or detect infected programs or codes, 
see., abstract, lines 8-10) and data across a high-speed communications network. The security agent 
provides real time detection of the presence of a suspected offending virus and can be dynamically 
reprogrammed in the event it becomes necessary (see., abstract, lines 10-15, col 3, lines 31-49). 
He also discloses the step of weighting operation to the importance of the security breaches (which 
is when a user enters a invalid login name password see., col 6, lines 18-28, col 22, lines 1-22). 
Shwed and Hershey et al. are analogous art because they are from the similar problem solving area 
of computer security. 

At the time of the invention it would have been obvious to a person of ordinary skill in the art to 
combine the inventions of Shwed and Hershey et al. 

One of ordinary skill in the art would have been motivated for doing so because it would produce a 
computer system that is capable of detecting intrusions by an adversary who attempts to gain access 
to a system using repeating login requests (see., Hershey et al. see., col 7, lines 16-19). Therefore, 
it would have been obvious to combine the inventions of Shwed and Hershey et al. to obtain the 
invention specified. 



CONCLUSION 

5. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is 
reminded of the extension of time policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the 
mailing date of this final action and the advisory action is not mailed until after the end of the 
THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the 
date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the date of this final action. 
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6. The prior art made of record and relied upon is considered to applicant's disclosure. 

7. Any inquiry concerning this communication from the examiner should be directed to Pierre 
Eddy Elisca at (703) 305-3987. The examiner can normally be reached on Tuesday to Friday from 
6:30AM to 5:00PM. 

If any attempt to reach the examiner by telephone is unsuccessftil, the examiner's supervisor, 
Robert W. Beausoleil Jr. can be reached on (703) 305-9713. 
Any response to this action should be mailed to : 
Commissioner of Patents of Trademarks Washington, D.C. 20231 
or faxed to : 

(703) 308-9051, (for formal communications intended for entry ) 
OR: 

(703) 305-3718, (for informal or draft communications, pleased label "PROPOSED" or"DRAFT") 
Hand-delivered responses should be brought to Crystal Park II, 2121 Crystal Drive, Arlington, VA., 
Sixth floor (receptionist). 





Patent Examiner 
February 14, 2000. 



